CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (page 2)
Page 2 of 8 — CVEs classified under CWE-367, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41259 | | 2026-06-03 | SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to r… | |
CVE-2026-35202 | | 2026-06-02 | Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass th… | |
CVE-2025-64390 | High | 7.4 | 2026-06-02 | A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through… |
CVE-2026-25260 | High | 7.8 | 2026-06-01 | Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications. |
CVE-2025-59610 | Medium | 6.4 | 2026-06-01 | Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer. |
CVE-2026-20454 | Medium | 6.4 | 2026-06-01 | In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2026-45619 | Medium | 6.5 | 2026-05-29 | WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolved… |
CVE-2026-46227 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDAL… |
CVE-2026-46159 | Medium | 4.7 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_i… |
CVE-2026-9796 | Medium | 6.5 | 2026-05-28 | A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability i… |
CVE-2026-45927 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: Require frozen map for calculating map hash Currently, bpf_map_get_info_by_fd calcul… |
CVE-2026-42336 | | 2026-05-26 | MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file servic… | |
CVE-2026-24191 | High | 7.8 | 2026-05-26 | NVIDIA Display Driver for Windows contains a vulnerability where an attacker could cause a time-of-check time-of-use issue. A successful exploit of this vulner… |
CVE-2026-45208 | High | 7.8 | 2026-05-21 | A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2025-71216 | High | 7.8 | 2026-05-21 | A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affect… |
CVE-2025-71215 | High | 7.0 | 2026-05-21 | A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate… |
CVE-2026-7837 | Low | 3.7 | 2026-05-21 | A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may all… |
CVE-2026-5947 | High | 7.5 | 2026-05-20 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it b… |
CVE-2026-29518 | High | 7.0 | 2026-05-20 | Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file write… |
CVE-2026-43619 | Medium | 6.3 | 2026-05-20 | Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir… |
CVE-2026-41702 | High | 7.8 | 2026-05-15 | VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with… |
CVE-2025-52532 | | 2026-05-15 | A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioc… | |
CVE-2022-23826 | | 2026-05-15 | A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially lead… | |
CVE-2026-42592 | Medium | 5.3 | 2026-05-14 | Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the privat… |
CVE-2026-41051 | Medium | 5.0 | 2026-05-13 | csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories. |
CVE-2026-35418 | High | 7.8 | 2026-05-12 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-42344 | Medium | 6.3 | 2026-05-08 | FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is v… |
CVE-2026-44694 | Critical | 9.1 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2… |
CVE-2026-34354 | High | 7.4 | 2026-05-08 | Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC s… |
CVE-2026-43433 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: avoid reading the written value in offsets array When sending a transaction… |
CVE-2026-43420 | Medium | 4.7 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix i_nlink underrun during async unlink During async unlink, we drop the `i_nlink`… |
CVE-2025-69233 | Medium | 6.5 | 2026-05-08 | Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platfor… |
CVE-2022-26522 | High | 7.8 | 2026-05-08 | The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in… |
CVE-2026-41002 | High | 7.2 | 2026-05-07 | The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-che… |
CVE-2026-44113 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside th… |
CVE-2026-44112 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes o… |
CVE-2026-43582 | Medium | 6.3 | 2026-05-06 | OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation… |
CVE-2026-34596 | High | 7.0 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race con… |
CVE-2026-7846 | Low | 2.6 | 2026-05-05 | A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/ser… |
CVE-2026-43529 | Low | 2.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to byp… |
CVE-2026-6180 | High | 8.1 | 2026-05-05 | A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving drop… |
CVE-2026-7791 | High | 7.8 | 2026-05-04 | Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows… |
CVE-2025-47407 | High | 7.8 | 2026-05-04 | Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level. |
CVE-2026-7724 | Medium | 5.0 | 2026-05-04 | A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate_restricted_url of the component… |
CVE-2026-37531 | Critical | 9.8 | 2026-05-01 | AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget ins… |
CVE-2026-43053 | Medium | 4.7 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation When inactivating an inode with node… |
CVE-2026-26206 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API b… |
CVE-2026-31678 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run a… |
CVE-2026-31535 | Medium | 4.7 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: make use of smbdirect_socket.recv_io.credits.available The logic off managin… |
CVE-2026-41360 | Medium | 6.7 | 2026-04-23 | OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. A… |
CVE-2026-41338 | Medium | 5.0 | 2026-04-23 | OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Atta… |
CVE-2026-41337 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback orig… |
CVE-2026-35376 | Medium | 4.5 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves… |
CVE-2026-35374 | Medium | 6.3 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking fo… |
CVE-2026-35364 | Medium | 6.3 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the des… |
CVE-2026-35362 | Low | 3.6 | 2026-04-22 | The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-rela… |
CVE-2026-35360 | Medium | 6.3 | 2026-04-22 | The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies… |
CVE-2026-35359 | Medium | 4.7 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility che… |
CVE-2026-35357 | Medium | 4.7 | 2026-04-22 | The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permis… |
CVE-2026-35356 | Medium | 6.3 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent dire… |
CVE-2026-35355 | Medium | 6.3 | 2026-04-22 | The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation un… |
CVE-2026-35354 | Medium | 4.7 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) pr… |
CVE-2026-35353 | Low | 3.3 | 2026-04-22 | The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically… |
CVE-2026-35352 | High | 7.0 | 2026-04-22 | A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-ba… |
CVE-2026-35345 | Medium | 5.3 | 2026-04-22 | A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU… |
CVE-2026-41651 | High | 8.8 | 2026-04-22 | PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit betw… |
CVE-2026-31523 | Medium | 4.7 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at… |
CVE-2026-22751 | Medium | 4.8 | 2026-04-21 | Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-c… |
CVE-2026-41296 | High | 8.2 | 2026-04-21 | OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Att… |
CVE-2026-40896 | Medium | 6.5 | 2026-04-20 | OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject a… |
CVE-2026-5958 | | 2026-04-20 | When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations o… | |
CVE-2026-3428 | | 2026-04-16 | A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation… | |
CVE-2026-1880 | | 2026-04-16 | An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protect… | |
CVE-2026-3590 | Medium | 6.5 | 2026-04-15 | Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link… |
CVE-2026-32093 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta… |
CVE-2026-27929 | High | 7.0 | 2026-04-14 | Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally. |
CVE-2026-33659 | Low | 3.5 | 2026-04-13 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulne… |
CVE-2026-35648 | Low | 3.7 | 2026-04-10 | OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. A… |
CVE-2026-4878 | Medium | 6.7 | 2026-04-09 | A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This… |
CVE-2026-32602 | Medium | 4.2 | 2026-04-06 | Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an… |
CVE-2026-27456 | Medium | 4.7 | 2026-04-03 | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SU… |
CVE-2026-30332 | High | 7.5 | 2026-04-02 | A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and e… |
CVE-2026-34452 | Medium | 5.3 | 2026-03-31 | The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local filesystem… |
CVE-2026-34224 | Medium | 4.4 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker… |
CVE-2026-32988 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinn… |
CVE-2026-32977 | Medium | 6.3 | 2026-03-31 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during… |
CVE-2026-32921 | Medium | 6.3 | 2026-03-31 | OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phas… |
CVE-2026-25704 | | 2026-03-30 | A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in cosmic-greeter can allow an attacker to regain privi… | |
CVE-2026-33574 | Medium | 6.2 | 2026-03-29 | OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutabl… |
CVE-2026-32979 | High | 7.3 | 2026-03-29 | OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval… |
CVE-2026-33624 | Low | 2.7 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacke… |
CVE-2026-23554 | High | 7.8 | 2026-03-23 | The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done und… |
CVE-2026-32043 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is valida… |
CVE-2026-31997 | Medium | 6.0 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable… |
CVE-2026-27670 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended de… |
CVE-2026-32943 | Low | 3.1 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset… |
CVE-2026-27545 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended… |
CVE-2025-22850 | | 2026-03-10 | Time-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosure. System software a… | |
CVE-2025-20028 | | 2026-03-10 | Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privilege. System software… | |
CVE-2026-31824 | High | 8.2 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enf… |